hyper-html-api 0.8.1 → 0.9.0

package/conformance/cases/write-outerhtml-unchanged.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{o:"#h@outerHTML"}</script><h1 id=h>Hi</h1>

package/conformance/cases/write-outerhtml-unchanged.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: ok
+note: "@outerHTML" is refused only when it would replace HTML; posting the extraction of the same rule back is a no-op like "@innerHTML".

package/conformance/cases/write-outerhtml-unchanged.write.json

@@ -0,0 +1,4 @@
+{
+  "changed": false,
+  "spliced": true
+}

package/conformance/cases/write-readonly-changed.data.json

@@ -0,0 +1 @@
+{"t":"Hi","tag":"H2"}

package/conformance/cases/write-readonly-changed.error.json

@@ -0,0 +1,6 @@
+{
+  "type": "RuleTargetReadOnly",
+  "message": "cannot write to read-only DOM property \"tagName\"",
+  "status": 500,
+  "details": null
+}

package/conformance/cases/write-readonly-changed.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{t:"#h",tag:"#h@tagName"}</script><h1 id=h>Hi</h1>

package/conformance/cases/write-readonly-changed.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: error
+note: A read-only property write that would change the value is still refused.

package/conformance/cases/write-readonly-unchanged.after.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{t:"#h",tag:"#h@tagName"}</script><h1 id=h>Hi</h1>

package/conformance/cases/write-readonly-unchanged.after.json

@@ -0,0 +1,4 @@
+{
+  "t": "Hi",
+  "tag": "H1"
+}

package/conformance/cases/write-readonly-unchanged.data.json

@@ -0,0 +1 @@
+{"t":"Hi","tag":"H1"}

package/conformance/cases/write-readonly-unchanged.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{t:"#h",tag:"#h@tagName"}</script><h1 id=h>Hi</h1>

package/conformance/cases/write-readonly-unchanged.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: ok
+note: Posting a read-only property back unchanged is a no-op, so a GET response round-trips.

package/conformance/cases/write-readonly-unchanged.write.json

@@ -0,0 +1,4 @@
+{
+  "changed": false,
+  "spliced": true
+}

package/conformance/cases/write-refused-animate.data.json

@@ -0,0 +1 @@
+{"v":"javascript:alert(1)"}

package/conformance/cases/write-refused-animate.error.json

@@ -0,0 +1,11 @@
+{
+  "type": "WriteRefused",
+  "message": "write refused: 1 write(s) broke the content-only policy",
+  "status": 400,
+  "details": [
+    {
+      "target": "<animate#a>",
+      "reason": "inside <animate>, which is not content"
+    }
+  ]
+}

package/conformance/cases/write-refused-animate.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{v:"#a@to"}</script><svg><animate id=a attributeName="href" to="#x"></animate></svg>

package/conformance/cases/write-refused-animate.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: error
+note: SVG animation elements can retarget href, so writing their to/values is refused like any other refused target.

package/conformance/cases/write-refused-attr-name.data.json

@@ -0,0 +1 @@
+{"v":"javascript:alert(1)"}

package/conformance/cases/write-refused-attr-name.error.json

@@ -0,0 +1,11 @@
+{
+  "type": "WriteRefused",
+  "message": "write refused: 1 write(s) broke the content-only policy",
+  "status": 400,
+  "details": [
+    {
+      "target": "<a#a>",
+      "reason": "attribute name \"href \" is not valid"
+    }
+  ]
+}

package/conformance/cases/write-refused-attr-name.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{v:"#a@href "}</script><a id=a href="/x">x</a>

package/conformance/cases/write-refused-attr-name.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: error
+note: An attribute name with a space in it is not a valid HTML attribute name, so the write is refused rather than serializing a live attribute.

package/conformance/cases/write-refused-data-url.data.json

@@ -0,0 +1 @@
+{"h":"data:text/html,x"}

package/conformance/cases/write-refused-data-url.error.json

@@ -0,0 +1,11 @@
+{
+  "type": "WriteRefused",
+  "message": "write refused: 1 write(s) broke the content-only policy",
+  "status": 400,
+  "details": [
+    {
+      "target": "<a#a>",
+      "reason": "\"data:\" URLs are not allowed in \"href\""
+    }
+  ]
+}

package/conformance/cases/write-refused-data-url.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{h:"#a@href"}</script><a id=a href="/">x</a>

package/conformance/cases/write-refused-data-url.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: error
+note: A data: URL in a URL attribute is refused.

package/conformance/cases/write-refused-innerhtml.data.json

@@ -0,0 +1 @@
+{"h":"<b>y</b>"}

package/conformance/cases/write-refused-innerhtml.error.json

@@ -0,0 +1,11 @@
+{
+  "type": "WriteRefused",
+  "message": "write refused: 1 write(s) broke the content-only policy",
+  "status": 400,
+  "details": [
+    {
+      "target": "<p#p>",
+      "reason": "\"@innerHTML\" writes HTML, only text is allowed"
+    }
+  ]
+}

package/conformance/cases/write-refused-innerhtml.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{h:"#p@innerHTML"}</script><p id=p>x</p>

package/conformance/cases/write-refused-innerhtml.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: error
+note: @innerHTML writes HTML, so the rule form itself is refused.

package/conformance/cases/write-refused-javascript-url.data.json

@@ -0,0 +1 @@
+{"h":"  JaVaScRiPt:alert(1)"}

package/conformance/cases/write-refused-javascript-url.error.json

@@ -0,0 +1,11 @@
+{
+  "type": "WriteRefused",
+  "message": "write refused: 1 write(s) broke the content-only policy",
+  "status": 400,
+  "details": [
+    {
+      "target": "<a#a>",
+      "reason": "\"javascript:\" URLs are not allowed in \"href\""
+    }
+  ]
+}

package/conformance/cases/write-refused-javascript-url.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{h:"#a@href"}</script><a id=a href="/">x</a>

package/conformance/cases/write-refused-javascript-url.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: error
+note: A javascript: URL is refused even behind leading spaces and mixed case.

package/conformance/cases/write-refused-list-removes-rules-tag.data.json

@@ -0,0 +1 @@
+{"r":[]}

package/conformance/cases/write-refused-list-removes-rules-tag.error.json

@@ -0,0 +1,11 @@
+{
+  "type": "WriteRefused",
+  "message": "write refused: 1 write(s) broke the content-only policy",
+  "status": 400,
+  "details": [
+    {
+      "target": "<p>",
+      "reason": "removing this would delete the data rules tag"
+    }
+  ]
+}

package/conformance/cases/write-refused-list-removes-rules-tag.html

@@ -0,0 +1 @@
+<div id=c><p class=r>A</p><p class=r>B<script type="application/json" data-rules-name="api" data-rules-version="1">{r:"#c .r[]"}</script></p></div>

package/conformance/cases/write-refused-list-removes-rules-tag.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: error
+note: Shrinking a list to zero rows would remove the row that holds the data rules tag, so it is refused.

package/conformance/cases/write-refused-multiple.data.json

@@ -0,0 +1 @@
+{"h":"javascript:1","o":"x"}

package/conformance/cases/write-refused-multiple.error.json

@@ -0,0 +1,15 @@
+{
+  "type": "WriteRefused",
+  "message": "write refused: 2 write(s) broke the content-only policy",
+  "status": 400,
+  "details": [
+    {
+      "target": "<a#a>",
+      "reason": "\"javascript:\" URLs are not allowed in \"href\""
+    },
+    {
+      "target": "<p#p>",
+      "reason": "attribute \"onclick\" can run script"
+    }
+  ]
+}

package/conformance/cases/write-refused-multiple.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{h:"#a@href",o:"#p@onclick"}</script><a id=a href="/">x</a><p id=p>y</p>

package/conformance/cases/write-refused-multiple.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: error
+note: One refused body reports every violation, not just the first.

package/conformance/cases/write-refused-onclick.data.json

@@ -0,0 +1 @@
+{"h":"alert(1)"}

package/conformance/cases/write-refused-onclick.error.json

@@ -0,0 +1,11 @@
+{
+  "type": "WriteRefused",
+  "message": "write refused: 1 write(s) broke the content-only policy",
+  "status": 400,
+  "details": [
+    {
+      "target": "<a#a>",
+      "reason": "attribute \"onclick\" can run script"
+    }
+  ]
+}

package/conformance/cases/write-refused-onclick.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{h:"#a@onclick"}</script><a id=a>x</a>

package/conformance/cases/write-refused-onclick.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: error
+note: An on* attribute write is refused because the attribute can run script.

package/conformance/cases/write-refused-rules-tag-ancestor.data.json

@@ -0,0 +1 @@
+{"t":"gone"}

package/conformance/cases/write-refused-rules-tag-ancestor.error.json

@@ -0,0 +1,11 @@
+{
+  "type": "WriteRefused",
+  "message": "write refused: 1 write(s) broke the content-only policy",
+  "status": 400,
+  "details": [
+    {
+      "target": "<div#d>",
+      "reason": "a text write here would delete the data rules tag"
+    }
+  ]
+}

package/conformance/cases/write-refused-rules-tag-ancestor.html

@@ -0,0 +1 @@
+<div id=d><p>x</p><script data-rules-name="api" data-rules-version="1">{t:"#d"}</script></div>

package/conformance/cases/write-refused-rules-tag-ancestor.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: error
+note: A write that would delete the data rules tag is refused.

package/conformance/cases/write-refused-script.data.json

@@ -0,0 +1 @@
+{"c":"alert(1)"}

package/conformance/cases/write-refused-script.error.json

@@ -0,0 +1,11 @@
+{
+  "type": "WriteRefused",
+  "message": "write refused: 1 write(s) broke the content-only policy",
+  "status": 400,
+  "details": [
+    {
+      "target": "<script#s>",
+      "reason": "inside <script>, which is not content"
+    }
+  ]
+}

package/conformance/cases/write-refused-script.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{c:"#s"}</script><script id=s>x</script>

package/conformance/cases/write-refused-script.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: error
+note: A text write inside script is refused by the content-only policy.

package/conformance/cases/write-shape-mismatch.data.json

@@ -0,0 +1 @@
+{"items":"A"}

package/conformance/cases/write-shape-mismatch.error.json

@@ -0,0 +1,12 @@
+{
+  "type": "ShapeMismatch",
+  "message": "shape mismatch: 1 field(s) failed validation",
+  "status": 400,
+  "details": [
+    {
+      "path": "items",
+      "expected": "array",
+      "got": "string"
+    }
+  ]
+}

package/conformance/cases/write-shape-mismatch.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{items:"li[]"}</script><ul><li>A</li></ul>

package/conformance/cases/write-shape-mismatch.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: error
+note: A scalar where the rule expects a list is a shape mismatch.

package/conformance/cases/write-text-basic.after.html

@@ -0,0 +1,3 @@
+<script data-rules-name="api" data-rules-version="1">{title:"h1"}</script>
+<h1 class="x">World</h1>
+<p>&copy;<br/></p>

package/conformance/cases/write-text-basic.after.json

@@ -0,0 +1,3 @@
+{
+  "title": "World"
+}

package/conformance/cases/write-text-basic.data.json

@@ -0,0 +1 @@
+{"title":"World"}

package/conformance/cases/write-text-basic.html

@@ -0,0 +1,3 @@
+<script data-rules-name="api" data-rules-version="1">{title:"h1"}</script>
+<h1 class='x'>Hello</h1>
+<p>&copy;<br/></p>

package/conformance/cases/write-text-basic.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: ok
+note: Scalar text write: the cheapest happy path, pinned as bytes on disk.

package/conformance/cases/write-text-basic.write.json

@@ -0,0 +1,4 @@
+{
+  "changed": true,
+  "spliced": true
+}

package/conformance/cases/write-text-escape.after.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{t:"#t"}</script><p id="t">a &lt; b &amp; c</p>

package/conformance/cases/write-text-escape.after.json

@@ -0,0 +1,3 @@
+{
+  "t": "a < b & c"
+}

package/conformance/cases/write-text-escape.data.json

@@ -0,0 +1 @@
+{"t":"a < b & c"}

package/conformance/cases/write-text-escape.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{t:"#t"}</script><p id=t>x</p>

package/conformance/cases/write-text-escape.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: ok
+note: Text is escaped on the way out, so markup in the body stays text.

package/conformance/cases/write-text-escape.write.json

@@ -0,0 +1,4 @@
+{
+  "changed": true,
+  "spliced": true
+}

package/conformance/cases/write-text-null-clears.after.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{t:"#t"}</script><p id="t"></p>

package/conformance/cases/write-text-null-clears.after.json

@@ -0,0 +1,3 @@
+{
+  "t": ""
+}

package/conformance/cases/write-text-null-clears.data.json

@@ -0,0 +1 @@
+{"t":null}

package/conformance/cases/write-text-null-clears.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{t:"#t"}</script><p id=t>x</p>

package/conformance/cases/write-text-null-clears.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: ok
+note: A null scalar empties the element's text instead of writing "null".

package/conformance/cases/write-text-null-clears.write.json

@@ -0,0 +1,4 @@
+{
+  "changed": true,
+  "spliced": true
+}

package/conformance/cases/write-type-attribute.after.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{t:"#i@type"}</script><input id="i" type="email" name="q">

package/conformance/cases/write-type-attribute.after.json

@@ -0,0 +1,3 @@
+{
+  "t": "email"
+}

package/conformance/cases/write-type-attribute.data.json

@@ -0,0 +1 @@
+{"t":"email"}

package/conformance/cases/write-type-attribute.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{t:"#i@type"}</script><input id=i type=text name=q>

package/conformance/cases/write-type-attribute.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: ok
+note: "@type" writes the type attribute; the element survives as an input with type="email".

package/conformance/cases/write-type-attribute.write.json

@@ -0,0 +1,4 @@
+{
+  "changed": true,
+  "spliced": true
+}

package/conformance/cases/write-unknown-key.data.json

@@ -0,0 +1 @@
+{"titel":"x"}

package/conformance/cases/write-unknown-key.error.json

@@ -0,0 +1,11 @@
+{
+  "type": "WriteRejected",
+  "message": "write rejected: 1 unknown key(s), 0 rule(s) with no matching element",
+  "status": 400,
+  "details": {
+    "unknownKeys": [
+      "titel"
+    ],
+    "unmatched": []
+  }
+}

package/conformance/cases/write-unknown-key.html

@@ -0,0 +1,3 @@
+<script data-rules-name="api" data-rules-version="1">{title:"h1"}</script>
+<h1 class='x'>Hello</h1>
+<p>&copy;<br/></p>

package/conformance/cases/write-unknown-key.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: error
+note: A body key the rules do not define is rejected before anything is written.

package/conformance/cases/write-unmatched.data.json

@@ -0,0 +1 @@
+{"sub":"x"}

package/conformance/cases/write-unmatched.error.json

@@ -0,0 +1,14 @@
+{
+  "type": "WriteRejected",
+  "message": "write rejected: 0 unknown key(s), 1 rule(s) with no matching element",
+  "status": 400,
+  "details": {
+    "unknownKeys": [],
+    "unmatched": [
+      {
+        "path": "sub",
+        "selector": "h2"
+      }
+    ]
+  }
+}

package/conformance/cases/write-unmatched.html

@@ -0,0 +1 @@
+<script data-rules-name="api" data-rules-version="1">{sub:"h2"}</script><p>x</p>

package/conformance/cases/write-unmatched.meta

@@ -0,0 +1,4 @@
+tier: 1
+face: write
+expect: error
+note: A scalar rule whose selector matches nothing is rejected.

package/conformance/write-policy.json

@@ -0,0 +1,78 @@
+{
+  "refusedRuleForms": [
+    "innerHTML",
+    "outerHTML"
+  ],
+  "refusedTargets": [
+    "script",
+    "style",
+    "template",
+    "noscript",
+    "iframe",
+    "object",
+    "embed",
+    "xmp",
+    "plaintext",
+    "noembed",
+    "noframes",
+    "meta",
+    "link",
+    "base",
+    "animate",
+    "set",
+    "animatemotion",
+    "animatetransform"
+  ],
+  "refusedAttributes": [
+    "style",
+    "srcdoc",
+    "is",
+    "http-equiv",
+    "sandbox",
+    "allow",
+    "nonce",
+    "integrity",
+    "charset",
+    "htmlclaytoken",
+    "htmlclayid",
+    "data-rules-name",
+    "data-rules-version",
+    "clay",
+    "contenteditable",
+    "no-save",
+    "no-snapshot",
+    "no-trigger-autosave",
+    "no-dirty",
+    "no-watch",
+    "no-undo",
+    "no-data",
+    "freeze",
+    "editor-ui"
+  ],
+  "refusedAttributePrefixes": [
+    "on"
+  ],
+  "urlAttributes": [
+    "href",
+    "src",
+    "srcset",
+    "action",
+    "formaction",
+    "poster",
+    "cite",
+    "data",
+    "ping",
+    "background",
+    "longdesc",
+    "usemap",
+    "xlink:href",
+    "manifest",
+    "codebase",
+    "icon"
+  ],
+  "refusedSchemes": [
+    "javascript",
+    "vbscript",
+    "data"
+  ]
+}